Good, but the author forgets to mention the one reason why you should have a desktop firewall, even if the client is connected behind the corporate firewall:

Isolation.

You isolate all other clients in the network from a mobile that may have been exposed to a public or maby a customer network ...

[ more ]  [ reply ]

I'd question the "old school" policy you described. I learned firewall policy 15+ years ago, which I think qualifies as "old school", and the rule then was default-deny: anything without an explicit allow rule is blocked. What you describe as old-school sounds to me like the relatively recent policy...

[ more ]  [ reply ]

Picky I know, but "Microsoft Windows doesn't support passive mode" is wrong. To the best of my knowledge it has always supported passive mode when browsing to an FTP url and XP, at least, supports the "quote PASV" command in the DOS FTP client.

Also in your example at the end of Page 1, you stat...

[ more ]  [ reply ]

You shouldn't block outgoing ICMP or else you could break PMTU....

[ more ]  [ reply ]

I would be interested in hearing the experiences with "context aware" policies (called "adaptive" by some vendors). The thought is implement a minimal policy for "off-site" (perhaps only allowing VPN access back to corporate and a few company-sanctioned web services) and a more open one for the corp...

[ more ]  [ reply ]